SC-100 Certification Practice Question #218

Question

You have a Microsoft 365 subscription.

You need to design a solution to block file downloads from Microsoft SharePoint Online by authenticated users on unmanaged devices.

Which two services should you include in the solution? Each correct answer presents part of the solution.

NOTE: Each correct selection is worth one point.

Accepted Answer

Blocking downloads from SharePoint Online on unmanaged devices is the textbook Defender for Cloud Apps Conditional Access App Control (CAAC) "block download" scenario — MS Learn explicitly lists "Block the download... on unmanaged devices" as an MDCA session-control activity. That session control only works when an Azure AD Conditional Access policy routes the user's session to the MDCA reverse proxy ("Conditional Access is a prerequisite to the feature"), so both A and E are each part of the solution. The user concern about "authenticated users" is addressed because the goal is to allow sign-in but limit the in-session download action, which is precisely what a session policy does rather than blocking access. The Suggested Answer marks only E, but the question asks for two services, so the community AE (CA + MDCA) is the complete, correct pair; the CE dissent loses because Purview labeling is not needed to merely block a download. Confidence is held at 88 due to the Suggested-vs-community asymmetry (single E vs AE) and the documented "authenticated users" debate.

More SC-100 practice questions